You need to be careful allowing users to use raw queries if you index sensitive information. Cross domain search timing attacks can be used to extract information from an index [1] if your form does not have XSRF protection.
If you allow raw queries it can also allow users to DOS your application by inputting slow queries.
[1] https://www.idontplaydarts.com/2015/09/cross-domain-timing-attacks-against-lucene/
SolrUtils::queryPhrase
(PECL solr >= 0.9.2)
SolrUtils::queryPhrase — Prepares a phrase from an unescaped lucene string
Description
Prepares a phrase from an unescaped lucene string.
Parameters
-
str -
The lucene phrase.
Return Values
Returns the phrase contained in double quotes.
add a note
User Contributed Notes 2 notes
quackfish at gmail dot com ¶
9 years ago
daniel dot allen at commercialtrucktrader dot com ¶
10 years ago
Doing some tests it would appear that this function also sanitizes input(testing on version above 1.0). And the term "phrase" is not the same as a complete query like "FIELD:THE RIGHT HALF AFTER THE : IS THE PHRASE."
So if you want to search SOME_FIELD:some value with an escape character like +, then you would have to write the code out:
$query = 'SOME_FIELD:' . SolrUtils::queryPhrase('some value with an escape character like +');
That would properly escape it like:
some value with an escape character like \+
FYI.
